Currently most information used to manage networks comes from monitoring network devices such as bridges and routers whose primary function is to control the passage of data packets between sections of the network. These devices generally provide information about their configuration and some interface statistics. The interface statistics are usually in the form of counts of different types of packets processed by the devices. These counts include the total number of correctly transmitted and received packets and the total number of errored packets, possibly broken down into other categories (i.e., cycle redundancy check, collision, runt, jabber etc).
The problem with these counts is that although they may be used to indicate a problem (such as an excessive packet collision rate) they do little to isolate the cause. Therefore, a traffic matrix is often useful. It breaks down the packet count into the contributions of each station on the network. For example, if the total packet count was high it is helpful to determine which pairs of network stations were communicating and their relative contributions to the packet count. It is only with this information that a decision can be made as to whether to move a station, add capacity or duplicate a service.
Calculating traffic matrices is an expensive operation that involves decoding every packet on the network. In addition large amounts of memory are used to build up the table. Thus, it is not surprising that network devices do not usually provide traffic matrices, since it would be too expensive and it would impair their primary function.
Currently if one wants to build up a traffic matrix an instrument is used. Such instruments generally comprise a receive means for detecting and receiving message packets carried on the network, and processing means operative to collect and process data from the packets received by the receive means. The packet data typically includes source and destination addresses. These instruments are usually too costly to leave in place and therefore a human intervention is required to interface the instrument to the network, collect the data, create a traffic matrix and then repeat the exercise for the next location to be monitored. This can be a difficult and time consuming task in a widely distributed network.
A further problem is that as networks become faster it becomes more difficult to design instruments that will support the data rate of the network.